[Unit]
Requires=le-app-codex-netns.service
After=le-app-codex-netns.service

[Service]
NetworkNamespacePath=/run/netns/le-app-codex
ProtectSystem=strict
PrivateTmp=yes
ProtectHome=yes
ProtectProc=invisible
ProcSubset=all
BindReadOnlyPaths=/etc/le-app-codex-runtime/resolv.conf:/etc/resolv.conf
TemporaryFileSystem=/srv:ro
BindPaths=/srv/le-app-codex:/srv/le-app-codex
TemporaryFileSystem=/var:ro
TemporaryFileSystem=/mnt:ro
TemporaryFileSystem=/media:ro
TemporaryFileSystem=/opt:ro
InaccessiblePaths=/var/www
InaccessiblePaths=/root
InaccessiblePaths=/home
InaccessiblePaths=/boot
InaccessiblePaths=/efi
InaccessiblePaths=/run/docker.sock
InaccessiblePaths=/var/run/docker.sock
InaccessiblePaths=/run/containerd/containerd.sock
InaccessiblePaths=/run/podman
InaccessiblePaths=/run/dbus/system_bus_socket
InaccessiblePaths=/run/systemd/private
InaccessiblePaths=/var/lib/docker
InaccessiblePaths=/var/lib/containerd
InaccessiblePaths=/var/lib/containers
InaccessiblePaths=/etc/docker
InaccessiblePaths=/etc/containers
InaccessiblePaths=/etc/ssh
InaccessiblePaths=/etc/NetworkManager/system-connections
InaccessiblePaths=/etc/wireguard
DevicePolicy=closed
DeviceAllow=/dev/fuse rw
DeviceAllow=/dev/net/tun rw